Multiple functions in the Android framework can be triggered to inject arbitrary SQL statements into the contacts database. The injection could allow an attacker to read or modify sensitive personal data and, because of the privilege model of the contacts provider, could promote a local application to a higher privilege context without requiring additional execution rights. Based on the description, this escalation could enable operations normally reserved for system level components.

The vulnerability affects devices running the Android operating system distributed by Google, including Android 14.0, 15.0, and 16.0 releases. The CPE data also lists the 16.0 qpr2 beta series (qpr2_beta_1, qpr2_beta_2, qpr2_beta_3), indicating that the flaw is present across these baseline and beta builds until a related security update is applied.

Exploitability appears high, as the vulnerability requires only local code execution on the device and no user interaction. The CVSS score of 7.8 indicates high severity, while the EPSS score of < 1% reflects a low probability of exploitation. This vulnerability is not listed in the CISA KEV catalog. An attacker with local access to a device containing the vulnerable component can exploit the flaw.